AIKIDO-2026-121628
tornado is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
tornadoTL;DR
Tornado's parse_multipart_form_data splits the request body into parts before checking the configured max_parts limit. A small multipart body containing many part separators forces creation of a large transient list of copied byte segments, amplifying memory use ahead of the limit check. This lets a single unauthenticated request trigger excessive memory allocation and denial of service. The fix bounds the number of parts before materializing them.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application accepts multipart/form-data request bodies.
Background info
tornado is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 6.5.7.
How to fix this
Upgrade the tornado library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant